CVE-2026-73659

HIGH 8.1

Trigger.dev: Cross-tenant object read/write via path traversal in packet presign API

CVSS Score

8.1

EPSS Score

0.0%

EPSS Percentile

0th

Trigger.dev is the open-source platform for building AI workflows in TypeScript. From 4.4.2 until 4.5.0, the packet presign routes in apps/webapp/app/routes/api.v1.packets.$.ts pass a caller-controlled filename through resolveStoreProtocolForPacketPresign to generatePresignedUrl and generatePresignedRequest in apps/webapp/app/v3/objectStore.server.ts, allowing .. traversal to escape the packets/<projectRef>/<env>/ object-store prefix and enabling a project API key to read or overwrite another organization's offloaded task payloads and outputs on multi-organization self-hosted instances. This issue is fixed in version 4.5.0.

CWE	CWE-22
Vendor	triggerdotdev
Product	trigger.dev
Published	Aug 13, 2026

Stay Ahead of the Next One

Get instant alerts for triggerdotdev trigger.dev

Be the first to know when new high vulnerabilities affecting triggerdotdev trigger.dev are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

triggerdotdev / trigger.dev

>= 4.4.2, < 4.5.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-m3mf-37q7-8928 github.com: https://github.com/triggerdotdev/trigger.dev/pull/3830 github.com: https://github.com/triggerdotdev/trigger.dev/commit/db4074df54db06b0656becf3f974345c90fa202e github.com: https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.0